SECURITY ALERTS

A Vulnerability (CVE-2022-39952) Exists in Fortinet FortiNAC Allowing for Arbitrary Code Execution

DESCRIPTION:
An external control of file name or path vulnerability (CVE-2022-39952) in FortiNAC webserver may allow an unauthenticated attacker to perform arbitrary write on the system.

 

AFFECTED RELEASES:
FortiNAC version 9.4.0
FortiNAC version 9.2.0 through 9.2.5
FortiNAC version 9.1.0 through 9.1.7
FortiNAC 8.8 all versions
FortiNAC 8.7 all versions
FortiNAC 8.6 all versions
FortiNAC 8.5 all versions
FortiNAC 8.3 all versions

 

SOLUTION:
1. Users and system administrators of affected products are advised to apply the security updates:
(1) Please upgrade to FortiNAC version 7.2.0, 9.1.8, 9.2.6 and 9.4.1 or above

 

REFERENCE:
1. https://www.fortinet.com/products/network-access-control
2. https://www.fortiguard.com/psirt/FG-IR-22-300
3. https://securityaffairs.com/142553/hacking/poc-exploit-code-fortinet-fortinac.html 
4. https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/
5. https://www.picussecurity.com/resource/blog/cve-2022-39952-fortinac-remote-code-execution-exploit-explained
6. https://nvd.nist.gov/vuln/detail/CVE-2022-39952
7. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39952
 

Back To Top